lkml.org 
[lkml]   [2014]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 3.16 059/158] fix regression in SCSI_IOCTL_SEND_COMMAND
Date
3.16-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tony Battersby <tonyb@cybernetics.com>

commit 2ba136daa3ae1e881c9f586f283fcaa164767dce upstream.

blk_rq_set_block_pc() memsets rq->cmd to 0, so it should come
immediately after blk_get_request() to avoid overwriting the
user-supplied CDB. Also check for failure to allocate rq.

Fixes: f27b087b81b7 ("block: add blk_rq_set_block_pc()")
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
block/scsi_ioctl.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)

--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -438,6 +438,11 @@ int sg_scsi_ioctl(struct request_queue *
}

rq = blk_get_request(q, in_len ? WRITE : READ, __GFP_WAIT);
+ if (!rq) {
+ err = -ENOMEM;
+ goto error;
+ }
+ blk_rq_set_block_pc(rq);

cmdlen = COMMAND_SIZE(opcode);

@@ -491,7 +496,6 @@ int sg_scsi_ioctl(struct request_queue *
memset(sense, 0, sizeof(sense));
rq->sense = sense;
rq->sense_len = 0;
- blk_rq_set_block_pc(rq);

blk_execute_rq(q, disk, rq, 0);

@@ -511,7 +515,8 @@ out:

error:
kfree(buffer);
- blk_put_request(rq);
+ if (rq)
+ blk_put_request(rq);
return err;
}
EXPORT_SYMBOL_GPL(sg_scsi_ioctl);



\
 
 \ /
  Last update: 2014-09-15 23:41    [W:1.708 / U:0.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site